CVE-2014-8118
Fixed in a distro release EPSS 8%
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
Products: rpm
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rpm | 4.11.3-1.1 |
| Debian 13 | rpm | 4.11.3-1.1 |
| Debian 14 | rpm | 4.11.3-1.1 |
| Debian 6.0 | rpm | 4.8.1-6+squeeze2 |
| Debian 7 | rpm | 4.10.0-5+deb7u2 |
| Red Hat Enterprise Linux 7 | rpm | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-apidocs | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-build | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-build-libs | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-cron | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-debuginfo | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-devel | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-libs | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-python | 0:4.11.1-18.el7_0 |
| Red Hat Enterprise Linux 7 | rpm-sign | 0:4.11.1-18.el7_0 |
| Ubuntu 14.04 LTS | rpm | 4.11.1-3ubuntu0.1 |